20ff36aec4494f87dc9515358faef0967fda06e89fe6568cbc31ffcafb895d72

HOSTILE

20ff36aec4494f87dc9515358faef0967fda06e89fe6568cbc31ffcafb895d72 · 92%

AI Unsigned WebSocket backdoor with registry mutation

Mal-ecule

K(Li)O₂(C₂Dy)H₇(Cm₇Cr₁₀DbMgOs₃Po₆Ti)Md₂(Bi₃)

Size 5.1 MB download

First seen 2 days ago

Analyzed 1 day ago

Ecosystem windows

Source abuse.ch

Also detected by 2 sources

Unsigned WebSocket agent with registry mutation and child-process tasking: file:0x3a4040

Unsigned Windows native WebSocket agent with child-process tasking: file:0x3a4108

file pe

0x1fed	204d756c7469706c69636174696f6e20	Multiplication
0x1ffd	666f72207838365f36342c2043525950	for x86_64, CRYP
0x200d	544f47414d53206279203c6874747073	TOGAMS by <https
0x201d	3a2f2f6769746875622e636f6d2f646f	://github.com/do
0x202d	742d61736d3e00909090909090909090	t-asm>..........
0x203d	9090905657535541544155415641579c	...VWSUATAUAVAW.
0x204d	4883ec40498b	H..@I.

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................Unsigned WebSocket agent with registry mutation and child-process tasking
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................Unsigned Windows native WebSocket agent with child-process tasking
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....Modify memory page protection
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x3a4968	000000003a000000486f73743a200000	....:...Host: ..
0x3a4978	557067726164653a20776562736f636b	Upgrade: websockUnsigned WebSocket agent with registry mutation and child-process tasking
0x3a4988	65740d0a00000000436f6e6e65637469	et......ConnectiUnsigned Windows native WebSocket agent with child-process tasking
0x3a4998	6f6e3a20557067726164650d0a000000	on: Upgrade.....
0x3a49a8	5365632d576562536f636b65742d5665	Sec-WebSocket-Ve
0x3a49b8	7273696f6e3a2031330d0a0000000000	rsion: 13.......
0x3a49c8	5365632d576562536f636b65742d4b65	Sec-WebSocket-Ke
0x3a49d8	793a200000000000557365722d416765	y: .....User-Age
0x3a49e8	6e74000000000000557365722d416765	nt......User-Age
0x3a49f8	6e743a20000000004f726967696e0000	nt: ....Origin..
0x3a4a08	3a2f2f00000000004f726967696e3a20	://.....Origin:
0x3a4a18	000000	...

0x4e23b4	00005700575341536f636b6574410000	..W.WSASocketA..
0x4e23c4	5753325f33322e646c6c000059004365	WS2_32.dll..Y.CeUnsigned Windows native WebSocket agent with child-process tasking
0x4e23d4	72744f70656e53746f72650012004365	rtOpenStore...Ce
0x4e23e4	7274436c6f736553746f	rtCloseSto

0x4e28ea	57696e646f7753746174696f6e00e601	WindowStation...
0x4e28fa	476574557365724f626a656374496e66	GetUserObjectInf
0x4e290a	6f726d6174696f6e570099024d657373	ormationW...Mess
0x4e291a	616765426f7857005553455233322e64	ageBoxW.USER32.d
0x4e292a	6c6c0000a40252656753657456616c75	ll....RegSetValu
0x4e293a	6545784100005f025265674372656174	eExA.._.RegCreatUnsigned WebSocket agent with registry mutation and child-process tasking
0x4e294a	654b6579457841005702526567436c6f	eKeyExA.W.RegClo
0x4e295a	73654b657900ed004465726567697374	seKey...Deregist
0x4e296a	65724576656e74	erEvent

Well-known

0x1fed	204d756c7469706c69636174696f6e20	Multiplication
0x1ffd	666f72207838365f36342c2043525950	for x86_64, CRYP
0x200d	544f47414d53206279203c6874747073	TOGAMS by <https
0x201d	3a2f2f6769746875622e636f6d2f646f	://github.com/do
0x202d	742d61736d3e00909090909090909090	t-asm>..........
0x203d	9090905657535541544155415641579c	...VWSUATAUAVAW.
0x204d	4883ec40498b	H..@I.

0xe8f0	4c895f18488b7c2408488b742410f3c3	L._.H.\|$.H.t$...
0xe900	583235353139207072696d6974697665	X25519 primitive
0xe910	7320666f72207838365f36342c204352	s for x86_64, CR
0xe920	5950544f47414d53206279203c687474	YPTOGAMS by <htt
0xe930	70733a2f2f6769746875622e636f6d2f	ps://github.com/
0xe940	646f742d61736d3e0090909090909090	dot-asm>........
0xe950	5657535541544155415641579c4883ec	VWSUATAUAVAW.H..
0xe960	40498b4078498b98	@I.@xI..

0x1d01b	696f6e20666f72207838365f36342c20	ion for x86_64,
0x1d02b	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0x1d03b	747470733a2f2f6769746875622e636f	ttps://github.co
0x1d04b	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0x1d05b	90909090905657535541544155415641	.....VWSUATAUAVA
0x1d06b	579c4883ec40498b4078	W.H..@I.@x

0x266d1	6f726d20666f72207838365f36342c20	orm for x86_64,
0x266e1	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0x266f1	747470733a2f2f6769746875622e636f	ttps://github.co
0x26701	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0x26711	90909090909090909090909090909090	................
0x26721	90909090909090909090	..........

0x1094e2	33303520666f72207838365f36342c20	305 for x86_64,
0x1094f2	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0x109502	747470733a2f2f6769746875622e636f	ttps://github.co
0x109512	6d2f646f742d61736d3e009090904c29	m/dot-asm>....L)
0x109522	c24c29c14d89ca49c1e904742690f342	.L).M..I...t&..B
0x109532	0f6f040266410fef00f3	.o..fA....

0x42550a	68657220666f72207838365f36342c20	her for x86_64,
0x42551a	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0x42552a	747470733a2f2f6769746875622e636f	ttps://github.co
0x42553a	6d2f646f742d61736d3e000000000000	m/dot-asm>......
0x42554a	0000000000000100000096010000b0c2	................
0x42555a	29400100000080c42940	)@......)@

Objectives

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x3a4968	000000003a000000486f73743a200000	....:...Host: ..
0x3a4978	557067726164653a20776562736f636b	Upgrade: websock
0x3a4988	65740d0a00000000436f6e6e65637469	et......Connecti
0x3a4998	6f6e3a20557067726164650d0a000000	on: Upgrade.....
0x3a49a8	5365632d576562536f636b65742d5665	Sec-WebSocket-Ve
0x3a49b8	7273696f6e3a2031330d0a0000000000	rsion: 13.......
0x3a49c8	5365632d576562536f636b65742d4b65	Sec-WebSocket-Ke
0x3a49d8	793a200000000000557365722d416765	y: .....User-Age
0x3a49e8	6e74000000000000557365722d416765	nt......User-Age
0x3a49f8	6e743a20000000004f726967696e0000	nt: ....Origin..
0x3a4a08	3a2f2f00000000004f726967696e3a20	://.....Origin:
0x3a4a18	000000	...

0x4e23b4	00005700575341536f636b6574410000	..W.WSASocketA..
0x4e23c4	5753325f33322e646c6c000059004365	WS2_32.dll..Y.Ce
0x4e23d4	72744f70656e53746f72650012004365	rtOpenStore...Ce
0x4e23e4	7274436c6f736553746f	rtCloseSto

0x4e28ea	57696e646f7753746174696f6e00e601	WindowStation...
0x4e28fa	476574557365724f626a656374496e66	GetUserObjectInf
0x4e290a	6f726d6174696f6e570099024d657373	ormationW...Mess
0x4e291a	616765426f7857005553455233322e64	ageBoxW.USER32.d
0x4e292a	6c6c0000a40252656753657456616c75	ll....RegSetValu
0x4e293a	6545784100005f025265674372656174	eExA.._.RegCreat
0x4e294a	654b6579457841005702526567436c6f	eKeyExA.W.RegClo
0x4e295a	73654b657900ed004465726567697374	seKey...Deregist
0x4e296a	65724576656e74	erEvent

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x3a4968	000000003a000000486f73743a200000	....:...Host: ..
0x3a4978	557067726164653a20776562736f636b	Upgrade: websock
0x3a4988	65740d0a00000000436f6e6e65637469	et......Connecti
0x3a4998	6f6e3a20557067726164650d0a000000	on: Upgrade.....
0x3a49a8	5365632d576562536f636b65742d5665	Sec-WebSocket-Ve
0x3a49b8	7273696f6e3a2031330d0a0000000000	rsion: 13.......
0x3a49c8	5365632d576562536f636b65742d4b65	Sec-WebSocket-Ke
0x3a49d8	793a200000000000557365722d416765	y: .....User-Age
0x3a49e8	6e74000000000000557365722d416765	nt......User-Age
0x3a49f8	6e743a20000000004f726967696e0000	nt: ....Origin..
0x3a4a08	3a2f2f00000000004f726967696e3a20	://.....Origin:
0x3a4a18	000000	...

0x4e23b4	00005700575341536f636b6574410000	..W.WSASocketA..
0x4e23c4	5753325f33322e646c6c000059004365	WS2_32.dll..Y.Ce
0x4e23d4	72744f70656e53746f72650012004365	rtOpenStore...Ce
0x4e23e4	7274436c6f736553746f	rtCloseSto

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4b0c10	7472696e674578000500000012000000	tringEx.........
0x4b0c20	456e756d53797374656d4c6f63616c65	EnumSystemLocale
0x4b0c30	73457800000000000100000013000000	sEx.............
0x4b0c40	466c7347657456616c75653200000000	FlsGetValue2....
0x4b0c50	000000	...

0x4e2de2	4c434d6170537472696e675700009102	LCMapStringW....
0x4e2df2	4765744c6f63616c65496e666f570000	GetLocaleInfoW..
0x4e2e02	c003497356616c69644c6f63616c6500	..IsValidLocale.
0x4e2e12	49034765745573657244656661756c74	I.GetUserDefault
0x4e2e22	4c43494400007b01456e756d53797374	LCID..{.EnumSyst
0x4e2e32	656d4c6f63616c6573570000c801466c	emLocalesW....Fl
0x4e2e42	75736846696c65427566666572730000	ushFileBuffers..
0x4e2e52	2902476574436f6e736f	).GetConso

Micro-behaviors

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x49b0f8	4449525f726561642822257322290000	DIR_read("%s")..
0x49b108	6c6f63616c686f73742f000000000000	localhost/......
0x49b118	66696c655f6f70656e00000000000000	file_open.......
0x49b128	66696c655f7365745f	file_set_

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4e2486	65496e666f726d6174696f6e0000fa00	eInformation....
0x4e2496	43726561746550697065000087014578	CreatePipe....Ex
0x4e24a6	69745468726561640000c805536c6565	itThread....Slee
0x4e24b6	70009d00436c6f736548616e646c6500	p...CloseHandle.
0x4e24c6	fd0043726561746550726f6365737341	..CreateProcessA
0x4e24d6	0000a0024765744d6f64756c6546696c	....GetModuleFil
0x4e24e6	654e616d654100009804526169736545	eNameA....RaiseE
0x4e24f6	7863657074696f6e00008d024765744c	xception....GetL
0x4e2506	617374457272	astErr

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4e23b4	00005700575341536f636b6574410000	..W.WSASocketA..
0x4e23c4	5753325f33322e646c6c000059004365	WS2_32.dll..Y.Ce
0x4e23d4	72744f70656e53746f72650012004365	rtOpenStore...Ce
0x4e23e4	7274436c6f736553746f	rtCloseSto

0x405fc0	00000000000000000000000000000000	................
0x405fd0	53696745643235353139206e6f204564	SigEd25519 no Ed
0x405fe0	323535313920636f6c6c6973696f6e73	25519 collisions
0x405ff0	00000000000000000000000000000000	................
0x406000	feffffffffff0f00feffffffffff0f00	................

0x453c3b	00000000004d4c2d4b454d2d3531323a	.....ML-KEM-512:
0x453c4b	4d4c4b454d3531323a69642d616c672d	MLKEM512:id-alg-
0x453c5b	6d6c2d6b656d2d3531323a322e31362e	ml-kem-512:2.16.
0x453c6b	3834302e312e3130	840.1.10

0x453c7b	31000000004d4c2d4b454d2d3736383a	1....ML-KEM-768:
0x453c8b	4d4c4b454d3736383a69642d616c672d	MLKEM768:id-alg-
0x453c9b	6d6c2d6b656d2d3736383a322e31362e	ml-kem-768:2.16.
0x453cab	3834302e312e3130	840.1.10

0x453cbc	000000004d4c2d4b454d2d313032343a	....ML-KEM-1024:
0x453ccc	4d4c4b454d313032343a69642d616c67	MLKEM1024:id-alg
0x453cdc	2d6d6c2d6b656d2d313032343a322e31	-ml-kem-1024:2.1
0x453cec	362e3834302e312e31	6.840.1.1

0x3af7c8	73736c5f646572697665000000000000	ssl_derive......
0x3af7d8	73736c5f646563617073756c61746500	ssl_decapsulate.
0x3af7e8	73736c5f656e63617073756c61746500	ssl_encapsulate.
0x3af7f8	73736c335f646f5f6368616e67655f63	ssl3_do_change_c
0x3af808	69706865725f737065630000000000	ipher_spec.....

0x3e0328	76705c6b656d2e630000000000000000	vp\kem.c........
0x3e0338	4556505f504b45595f656e6361707375	EVP_PKEY_encapsu
0x3e0348	6c617465000000004556505f504b4559	late....EVP_PKEY
0x3e0358	5f646563617073756c61746500000000	_decapsulate....
0x3e0368	6576705f6b656d5f66726f6d5f616c67	evp_kem_from_alg
0x3e0378	6f726974686d00007472795f	orithm..try_

0x3dcfe0	3a00000020092c006c6f61645f697600	:... .,.load_iv.
0x3dcff0	2d2d2d2d2d424547494e20002d2d2d2d	-----BEGIN .----
0x3dd000	2d0a0000000000002d2d2d2d2d454e44	-.......-----END
0x3dd010	200000000000000050454d5f77726974	.......PEM_writ
0x3dd020	655f62696f0000006765745f6e616d65	e_bio...get_name

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x3a5518	e0d212400100000050d3124001000000	...@....P..@....
0x3a5528	2d2d2d2d2d424547494e204345525449	-----BEGIN CERTI
0x3a5538	4649434154452d2d2d2d2d0000000000	FICATE-----.....
0x3a5548	000000000000000070e2124001000000	........p..@....
0x3a5558	70e212400100	p..@..

0x3b7d00	3530395c783530395f6c752e63000000	509\x509_lu.c...
0x3b7d10	583530395f53544f52455f6e65770000	X509_STORE_new..
0x3b7d20	583530395f53544f52455f6164645f6c	X509_STORE_add_l
0x3b7d30	6f6f6b7570000000583530395f53544f	ookup...X509_STO
0x3b7d40	52455f6164645f636572740000000000	RE_add_cert.....
0x3b7d50	583530395f53544f52455f6164645f63	X509_STORE_add_c
0x3b7d60	726c0000000000000000000000000000	rl..............
0x3b7d70	70943b4001	p.;@.

0x3b80a8	3530395c783530395f76706d2e630000	509\x509_vpm.c..
0x3b80b8	583530395f5645524946595f50415241	X509_VERIFY_PARA
0x3b80c8	4d5f7365743100000000000000000000	M_set1..........
0x3b80d8	0200000000	.....

0x3b8390	657874656e73696f6e73000000000000	extensions......
0x3b83a0	583530395f43494e4600000000000000	X509_CINF.......
0x3b83b0	636572745f696e666f00000000000000	cert_info.......
0x3b83c0	7369675f61	sig_a

0x3dab20	7573652d626974730000000000000000	use-bits........
0x3dab30	4556505f504b45595f4354585f736574	EVP_PKEY_CTX_set
0x3dab40	5f67726f75705f6e616d650067726f75	_group_name.grou
0x3dab50	7000000062697473	p...bits

0x3db008	a0ac3a40010000004448580000000000	..:@....DHX.....
0x3db018	4556505f504b45595f6765745f626974	EVP_PKEY_get_bit
0x3db028	730000000000000063727970746f5c65	s.......crypto\e
0x3db038	76705c705f6c69622e63000000000000	vp\p_lib.c......
0x3db048	4556505f504b45595f6765745f736563	EVP_PKEY_get_sec
0x3db058	75726974795f62697473000000000000	urity_bits......
0x3db068	4556505f504b45595f636f70795f7061	EVP_PKEY_copy_pa
0x3db078	72616d65746572730000000070726976	rameters....priv
0x3db088	0000000000000000	........

0x3db0d8	5f676574305f44485f696e7400000000	_get0_DH_int....
0x3db0e8	4556505f504b45595f6e657700000000	EVP_PKEY_new....
0x3db0f8	706b65795f7365745f74797065000000	pkey_set_type...
0x3db108	4556505f504b45595f7365745f747970	EVP_PKEY_set_typ
0x3db118	655f62795f6b65796d676d7400000000	e_by_keymgmt....
0x3db128	4556505f504b45595f64757000000000	EVP_PKEY_dup....
0x3db138	4556505f504b45595f6765745f73697a	EVP_PKEY_get_siz
0x3db148	65000000000000006c65676163792d6f	e.......legacy-o
0x3db158	626a656374000000	bject...

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4e28ea	57696e646f7753746174696f6e00e601	WindowStation...
0x4e28fa	476574557365724f626a656374496e66	GetUserObjectInf
0x4e290a	6f726d6174696f6e570099024d657373	ormationW...Mess
0x4e291a	616765426f7857005553455233322e64	ageBoxW.USER32.d
0x4e292a	6c6c0000a40252656753657456616c75	ll....RegSetValu
0x4e293a	6545784100005f025265674372656174	eExA.._.RegCreat
0x4e294a	654b6579457841005702526567436c6f	eKeyExA.W.RegClo
0x4e295a	73654b657900ed004465726567697374	seKey...Deregist
0x4e296a	65724576656e74	erEvent

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4e2756	61736553656d6170686f726500002506	aseSemaphore..%.
0x4e2766	57616974466f7253696e676c654f626a	WaitForSingleObj
0x4e2776	65637400680247657445786974436f64	ect.h.GetExitCod
0x4e2786	65546872656164000601437265617465	eThread...Create
0x4e2796	53656d6170686f726541000064024765	SemaphoreA..d.Ge
0x4e27a6	74456e7669726f6e6d656e7456617269	tEnvironmentVari
0x4e27b6	61626c655700db014765744143500000	ableW...GetACP..
0x4e27c6	030347657453746448616e646c650000	..GetStdHandle..
0x4e27d6	6006577269746546696c6500a5024765	`.WriteFile...Ge
0x4e27e6	744d6f64756c6548616e646c65570000	tModuleHandleW..
0x4e27f6	b900436f6e766572744669	..ConvertFi

0x3a3ff8	0000000000000000000100002c010000	............,...
0x3a4008	ffffffff000000000000000000000000	................
0x3a4018	00000000000000000000000000000000	................
0x3a4028	00000000000000000000000000000000	................
0x3a4038	00000000000000000000000000000000	................
0x3a4048	00000000000000000000000000000000	................
0x3a4058	00000000000000000000000000000000	................
0x3a4068	00000000000000000000000000000000	................
0x3a4078	00000000000000000000000000000000	................
0x3a4088	00000000000000000101010101010101	................
0x3a4098	01010101010101010909090909090909	................
0x3a40a8	09090909090909090707070707070707	................
0x3a40b8	07070707070707070707070707070707	................
0x3a40c8	07070707070707070808020202020202	................
0x3a40d8	02020202020202020202020202020202	................
0x3a40e8	02020202020202020a03030303030303	................
0x3a40f8	03030303030403030b06060605080808	................
0x3a4108	08080808080808080001020305080701	................
0x3a4118	01010406010101010101010101010101	................
0x3a4128	01010101010101010100010101010100	................
0x3a4138	01000101010101010102010101010102	................
0x3a4148	01020101010101010101010101010102	................
0x3a4158	01010101010101010102010101010101	................
0x3a4168	01020101010101010101010101010103	................
0x3a4178	01030101010101010103010101010103	................
0x3a4188	01030101010101010103010101010101	................
0x3a4198	010101010101010180c14b4001000000	..........K@....
0x3a41a8	401411400100000000aa104001000000	@..@.......@....
0x3a41b8	50c24b40010000001061114001000000	P.K@.....a.@....
0x3a41c8	00aa1040010000003a20000000000000	...@....: ......
0x3a41d8	d8c24b40010000001061114001000000	..K@.....a.@....
0x3a41e8	00aa10400100000068c34b4001000000	...@....h.K@....
0x3a41f8	e06011400100000070ad114001000000	.`.@....p..@....
0x3a4208	c0ac1140010000005083114001000000	...@....P..@....
0x3a4218	40a811400100000060a8114001000000	@..@....`..@....
0x3a4228	696f73747265616d0000000000000000	iostream........
0x3a4238	696f73747265616d2073747265616d20	iostream stream
0x3a4248	6572726f7200000066616c7365000000	error...false...
0x3a4258	7472756500000000e8c34b4001000000	true......K@....
0x3a4268	e05f1140010000008016114001000000	._.@.......@....
0x3a4278	9014114001000000b0a5114001000000	...@.......@....
0x3a4288	a0a511400100000010a6114001000000	...@.......@....
0x3a4298	00a6114001000000b0a6114001000000	...@.......@....
0x3a42a8	c0171140010000008096114001000000	...@.......@....
0x3a42b8	c01711400100000088c44b4001000000	...@......K@....
0x3a42c8	106111400100000000aa104001000000	.a.@.......@....
0x3a42d8	d0bb4b40010000006061114001000000	..K@....`a.@....
0x3a42e8	696f735f626173653a3a626164626974	ios_base::badbit

0x4e2486	65496e666f726d6174696f6e0000fa00	eInformation....
0x4e2496	43726561746550697065000087014578	CreatePipe....Ex
0x4e24a6	69745468726561640000c805536c6565	itThread....Slee
0x4e24b6	70009d00436c6f736548616e646c6500	p...CloseHandle.
0x4e24c6	fd0043726561746550726f6365737341	..CreateProcessA
0x4e24d6	0000a0024765744d6f64756c6546696c	....GetModuleFil
0x4e24e6	654e616d654100009804526169736545	eNameA....RaiseE
0x4e24f6	7863657074696f6e00008d024765744c	xception....GetL
0x4e2506	617374457272	astErr

Metadata

20 of 38 traits shown

Identity

SHA-256	20ff36aec4494f87dc9515358faef0967fda06e89fe6568cbc31ffcafb895d72
Filename	file
Package	20ff36aec4494f87dc9515358faef0967fda06e89fe6568cbc31ffcafb895d72

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	windows
Domain	abuse.ch

Timeline

First seen	22 Jul 2026 17:11 UTC
First analyzed	23 Jul 2026 04:11 UTC
Last analyzed	23 Jul 2026 04:52 UTC
Last updated	23 Jul 2026 04:52 UTC

Labeling

Label	bad
Label source	harvest
Traits version	2678d

Not seeing what you expected? Let us know

0x3dcf47	00504b4353202337205349474e454420	.PKCS #7 SIGNED
0x3dcf57	4441544100434d530045787065637469	DATA.CMS.Expecti
0x3dcf67	6e673a20000000000050454d5f41534e	ng: .....PEM_ASN
0x3dcf77	315f7772	1_wr

0x3b5330	4145532d3235362d4543420000000000	AES-256-ECB.....
0x3b5340	43686143686132300000000000000000	ChaCha20........
0x3b5350	6f73736c5f717569635f6864725f7072	ossl_quic_hdr_pr
0x3b5360	6f746563746f725f	otector_

0x4a9270	10000000100000001000000010000000	................
0x4a9280	657870616e642033322d62797465206b	expand 32-byte k
0x4a9290	00436861436861323020666f72207838	.ChaCha20 for x8
0x4a92a0	365f36342c2043525950544f47414d53	6_64, CRYPTOGAMS

0x3b54d8	feffffffffffffff0000000010000000	................
0x3b54e8	43686143686132302d506f6c79313330	ChaCha20-Poly130
0x3b54f8	35000000000000006b65792d63686563	5.......key-chec
0x3b5508	6b0000000000000073736c5c71756963	k.......ssl\quic
0x3b5518	5c	\

0x3d4790	6165732d3139322d6374720000000000	aes-192-ctr.....
0x3d47a0	4145532d3235362d4354520000000000	AES-256-CTR.....
0x3d47b0	6165732d3235362d6374720000000000	aes-256-ctr.....
0x3d47c0	69642d63616d656c6c69613132382d77	id-camellia128-w
0x3d47d0	726170000000000069642d	rap.....id-

0x49e970	6dbbbbd66dbbbbd62c16163a2c16163a	m...m...,..:,..:
0x49e980	637c777bf26b6fc53001672bfed7ab76	c\|w{.ko.0.g+...v
0x49e990	ca82c97dfa5947f0add4a2af9ca472c0	...}.YG.......r.
0x49e9a0	b7fd9326363ff7cc34a5e5f171d83115	...&6?..4...q.1.
0x49e9b0	04c723c3189605	..#....

0x4bcc20	c71b104781e5bef4271619aa1e000000	...G....'.......
0x4bcc30	443a5c6465726d6f5c7265706f735c62	D:\dermo\repos\b
0x4bcc40	6f626e65745c7836345c52656c656173	obnet\x64\Releas
0x4bcc50	655c626f626e65745f636c2e70646200	e\bobnet_cl.pdb.
0x4bcc60	00000000b8040000b504000000000000	................
0x4bcc70	440100004743544c00100000a09310	D...GCTL.......

0x3e8668	253032642e252e2a735a000000000000	%02d.%.*sZ......
0x3e8678	25732025326420253032643a25303264	%s %2d %02d:%02d
0x3e8688	3a253032642e252e2a7320256420474d	:%02d.%.*s %d GM
0x3e8698	54000000000000002534642d25303264	T.......%4d-%02d
0x3e86a8	2d2530	-%0